From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.7 required=3.0 tests=DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,DKIM_VALID,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7758AC43381 for ; Sun, 10 Mar 2019 18:59:05 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 43E3620657 for ; Sun, 10 Mar 2019 18:59:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="tidkVuPY"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="a9fshGZZ" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 43E3620657 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:References: In-Reply-To:Message-Id:Date:Subject:To:From:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=IeYAX9HXfiFOxAyg9c+oNX4cGHjwBrdbOvQMbJE4O7g=; b=tidkVuPYehk4ly/MClezUA0s5l UPb72/Xh+t48o6VSkwIzfj7OKM87FH+TRzeQTpdv7CRNISeisUzHVIhxgul0tSFUXLlxHhpN+2p1a G2ZSCGQZqhwjjSJAUKaDl0QEI6SB24B8+q4I1Y9IdS+6xw8aazkgDxBA51FWm0aCiJIb+lOK9ii7M u+kUXsYiPfPdONaFm8+iSfP7vDJ6WpKiT9RNk5Lfd9HAHTMN/l/508C8kg2P+wtaQicQWd8ER7z3E wK2VkLu0yv4jMSPydOunj6gOZPXMSx2sXYsKcjByrUEGdsn4Litx1uMYKfhiAzFhqdytoAKk60Hf4 sH+DeXuQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1h33f2-0000JO-4r; Sun, 10 Mar 2019 18:59:00 +0000 Received: from mail-it1-x141.google.com ([2607:f8b0:4864:20::141]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1h33ef-0008Ha-Km for linux-arm-kernel@lists.infradead.org; Sun, 10 Mar 2019 18:58:40 +0000 Received: by mail-it1-x141.google.com with SMTP id g17so3894465ita.2 for ; Sun, 10 Mar 2019 11:58:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=fxgFiCRKgpoCxt3b7qAJzupwn0XavxwiX5uUbpM/OII=; b=a9fshGZZ7i/tLOZepomjCBDfixyvFGzizvaDmgosBgbXN7+q1UJ/ZsN5OMR7TXZO3s OZsLl6fn5MRTxgtWXvRFdonnegXiOaRpFUqi+BHCHk4QjwpF+oxN+I5uNuEo4aOxZ7bZ r3fpKQHgmXCmSfjPDLwXnbs4/ueXM4Q9UrvmuK57Ao1e8UzEoS6wTrrZRp7cJJfs+zJq KtTwS33zSuk6UDDDspaMdOJHuUwGaDrS1JU04+N5oLT71uISpVnTdm0I4ZRxnBW7Qa4q bc2JXN+ybhDqk23+9lFgSLQBqaT+oyXxRhLcNPTVLQlQWMtEy1zu1v6pAlY60w5GoBuV a6xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=fxgFiCRKgpoCxt3b7qAJzupwn0XavxwiX5uUbpM/OII=; b=rGQwoMWE63oof1RMbTNbAp6boVDVw+YPxnhjuVSuvEZfhd9bFHMBsqf50FEpG35TKP x3ebHwrXUaQLFoc+o0o5P6XHNCPO3IeDRnbuOq7O9VGVpTWIL8gSCdObrxWqdEEC7NBX fcwmC7OnRkY+0CzfQsskyotZqZQRqys/1AdamWfLTnUjs5YJJ96fe/JDN2B41tYXIWiq yWapDBD0MH4Z7k6BKSL7uFylA+ydm7mCkiQ59W+L94nqQaufeeRLM2ho9r45RPHZTpc0 /IlJr1o6aiema78za1hSJxKyov1phlpAkK9iB2cVoT+0Cpj/NAuYE7VI2KIz/ywDWcw7 Q/Aw== X-Gm-Message-State: APjAAAW6s3JBqDBVmAzaj8/LMcHuY6QiV3epzcRtBN/xZ5u3GUW/9eRo NKy5xduaLnzVdgRjDZs9b1Y= X-Google-Smtp-Source: APXvYqyGASuFsKMDYrVtGpg9O7HRaj1RL78fLP+QSyIZRt5Ha5mt6iBOlsy3QMRJjIlQs682yv+8YA== X-Received: by 2002:a24:1cc6:: with SMTP id c189mr12881577itc.74.1552244315449; Sun, 10 Mar 2019 11:58:35 -0700 (PDT) Received: from localhost.localdomain ([198.52.185.227]) by smtp.gmail.com with ESMTPSA id y18sm1359270ioa.56.2019.03.10.11.58.34 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 10 Mar 2019 11:58:35 -0700 (PDT) From: Sven Van Asbroeck X-Google-Original-From: Sven Van Asbroeck To: Jonathan Cameron Subject: [PATCH 2/3] iio: adc: xilinx: fix potential use-after-free on probe Date: Sun, 10 Mar 2019 14:58:25 -0400 Message-Id: <20190310185826.25916-2-TheSven73@gmail.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190310185826.25916-1-TheSven73@gmail.com> References: <20190310185826.25916-1-TheSven73@gmail.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20190310_115837_676876_7C066B83 X-CRM114-Status: GOOD ( 11.94 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Lars-Peter Clausen , linux-iio@vger.kernel.org, Michal Simek , linux-kernel@vger.kernel.org, Manish Narani , Peter Meerwald-Stadler , Hartmut Knaack , linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+infradead-linux-arm-kernel=archiver.kernel.org@lists.infradead.org If probe errors out after request_irq(), its error path does not explicitly cancel the delayed work, which may have been scheduled by the interrupt handler. This means the delayed work may still be running when the core frees the private structure (struct xadc). This is a potential use-after-free. Fix by inserting cancel_delayed_work_sync() in the probe error path. Signed-off-by: Sven Van Asbroeck --- drivers/iio/adc/xilinx-xadc-core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c index 1960694e8007..15e1a103f37d 100644 --- a/drivers/iio/adc/xilinx-xadc-core.c +++ b/drivers/iio/adc/xilinx-xadc-core.c @@ -1290,6 +1290,7 @@ static int xadc_probe(struct platform_device *pdev) err_free_irq: free_irq(xadc->irq, indio_dev); + cancel_delayed_work_sync(&xadc->zynq_unmask_work); err_clk_disable_unprepare: clk_disable_unprepare(xadc->clk); err_free_samplerate_trigger: -- 2.17.1 _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel